← Back to all news
arXiv AI By Adrians Skapars, Edoardo Manino, Youcheng Sun, Lucas C. Cordeiro

GPT, But Backwards: Exactly Inverting Language Model Outputs

Read the original on arXiv AI →

The paper introduces Sparse One-hot Discrete Adam (SODA), a white‑box search algorithm that can reconstruct textual inputs from partial knowledge of a language model’s output logits. SODA can recover natural sequences of up to 17 tokens with no false positives, outperforming prior methods by a factor of four in exact‑match reconstruction. The authors demonstrate that input length and vocabulary size are more critical to inversion difficulty than model size, and provide proof‑of‑concept security applications, including recovering backdoor triggers and personally identifiable information from a poisoned LLM and synthetic user‑chatbot interactions.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Related stories

arXiv AI
Oct 19

Rep2Text: Decoding Full Text from a Single LLM Token Representation

The paper introduces Rep2Text, a method that reconstructs text from a single hidden representation of a large language model. Experiments show that for short passages (~16 words) about half the words can be recovered while preserving overall meaning, and even longer texts retain recoverable main ideas. These results suggest that hidden representations encode more information than previously thought, raising concerns about privacy.

By Haiyan Zhao, Zirui He, Yiming Tang, Fan Yang, Ali Payani, Dianbo Liu, Mengnan Du
llmssafety
More like this →
arXiv AI
Oct 28

LLMs Can Leak Training Data But Do They Want To? Evaluating Memorization Propensity in LLMs

The paper introduces PropMe, a framework that evaluates both the capability of large language models (LLMs) to reproduce training data via prefix attacks and their natural propensity to do so without adversarial prompting. Using SimpleTrace to compare every generation against the full indexed training corpus, the authors test models such as Comma, DFM Decoder, and OLMo3 32B across datasets like Common Pile, Dynaword, and Dolma3. Results show that natural sentence prompts produce less training text than prefix attacks, but unprompted or single-word prompts can reproduce as much or more, often involving duplicated licenses, code, and templates; continual pre‑training only modestly reduces verbatim reproduction.

By Gianluca Barmina, Peter Schneider-Kamp, Lukas Galke Poech
llmssafety
More like this →